Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

How to deploy Splunk using a universal forwarder through Tivoli Endpoint Manager (TEM)?

0

Hi Guys,

We are at a phase where we need to deploy universal forwarder setup through Tivoli Endpoint Manager (TEM) over multiple servers.However, for deploying through Tivoli, we need to create fixlets.Is there any way to get the batch file from the Splunk Universal Forwarder or is there any other method to give it a try?

Thnaks for the response was a great heplManged to deploy it by tivoliHowever We deployed Splunk universal forwarder through tivoli which was pointing to the deployment server. On deploying it we found out that there is a inputs.conf getting created in local folder with only the hostname. We deployed Splunk-TA-Winodows through deployment server.Using a batch file we appended the inputs.conf host data form system/local to Splunk-TA-Windows/local/inputs.conf and deleted the inputs.conf and restarted splunkd. All worked fine.Now we have the Splunk-TA-Winodws deployed through deployment servrer, when the client phones home it removes the hostname as there and keeps the conf file present in the deployment app?How can i add the host details in splunk without getting it override ?I have 100 servers in all and want the hostname of each present in the inputs.conf of the TA ?

If you're deploying Splunk_TA_windows through Deployment Server, it will control the whole app. However, any settings that you put in etc/system/local/inputs.conf will be merged with what's in the app and take precedence in the case of a conflict. Therefore, putting the hostname in etc/system/local/inputs.conf should do exactly what you want. You can always create local apps that aren't managed by Deployment Server, too, but in this particular case it's probably appropriate to use etc/system/local/inputs.conf.

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.